@lunora/auth 1.0.0-alpha.32 → 1.0.0-alpha.34

package/dist/adapter.d.mts

@@ -2,42 +2,42 @@ import { createAdapterFactory } from 'better-auth/adapters';
 import { d1Executor } from "./sql-store.mjs";
 import { AuthStore } from "./store.mjs";
 /**
-* A better-auth database adapter backed by an {@link AuthStore} — the bridge
-* that routes better-auth's reads and writes through Lunora's data layer
-* instead of better-auth's built-in D1/Kysely adapter. Pass the result as
-* `createAuth({ database: lunoraAuthAdapter(store) })`; better-auth's
-* `createAdapterFactory` handles id generation, default values, field-name
-* mapping and output shaping, so this only translates the cleaned CRUD calls
-* onto the store.
-*
-* ```ts
-* const auth = createAuth({
-*     secret: env.AUTH_SECRET,
-*     emailAndPassword: { enabled: true },
-*     database: lunoraAuthAdapter(lunoraStore), // lunoraStore writes via ctx.db
-* });
-* ```
-*
-* Scope: the {@link AuthStore} interface is single-table CRUD. better-auth's
-* relational `join` reads (an advanced opt-in) are not handled — pair the
-* adapter with `disableJoins` or let better-auth fall back to per-table reads.
-*/
+ * A better-auth database adapter backed by an {@link AuthStore} — the bridge
+ * that routes better-auth's reads and writes through Lunora's data layer
+ * instead of better-auth's built-in D1/Kysely adapter. Pass the result as
+ * `createAuth({ database: lunoraAuthAdapter(store) })`; better-auth's
+ * `createAdapterFactory` handles id generation, default values, field-name
+ * mapping and output shaping, so this only translates the cleaned CRUD calls
+ * onto the store.
+ *
+ * ```ts
+ * const auth = createAuth({
+ *     secret: env.AUTH_SECRET,
+ *     emailAndPassword: { enabled: true },
+ *     database: lunoraAuthAdapter(lunoraStore), // lunoraStore writes via ctx.db
+ * });
+ * ```
+ *
+ * Scope: the {@link AuthStore} interface is single-table CRUD. better-auth's
+ * relational `join` reads (an advanced opt-in) are not handled — pair the
+ * adapter with `disableJoins` or let better-auth fall back to per-table reads.
+ */
 declare const lunoraAuthAdapter: (store: AuthStore) => ReturnType<typeof createAdapterFactory>;
 /**
-* One-liner for the common case: a better-auth `database` backed by a Cloudflare
-* D1 binding, via Lunora's SQL store — equivalent to
-* `lunoraAuthAdapter(createSqlAuthStore(d1Executor(d1)))`.
-*
-* Prefer this over passing the raw `env.DB` as `database`. With raw D1,
-* better-auth resolves its Kysely adapter through a runtime `await import(...)`
-* inside `auth.$context`, and that dynamic import never settles under
-* `@cloudflare/vite-plugin`'s worker runner — so it hangs *every* auth request
-* in `pnpm dev` (a standalone `wrangler dev` or a deployed worker bundle it
-* up-front, so they're unaffected — which makes the hang baffling to debug).
-* This explicit adapter skips that import entirely, so dev and prod behave the
-* same. The migration instance is the one exception — it wants raw `env.DB` so
-* `ensureMigrated`'s Kysely migrator can create the tables (its `$context` is
-* never resolved, so the hang doesn't apply there).
-*/
+ * One-liner for the common case: a better-auth `database` backed by a Cloudflare
+ * D1 binding, via Lunora's SQL store — equivalent to
+ * `lunoraAuthAdapter(createSqlAuthStore(d1Executor(d1)))`.
+ *
+ * Prefer this over passing the raw `env.DB` as `database`. With raw D1,
+ * better-auth resolves its Kysely adapter through a runtime `await import(...)`
+ * inside `auth.$context`, and that dynamic import never settles under
+ * `@cloudflare/vite-plugin`'s worker runner — so it hangs *every* auth request
+ * in `pnpm dev` (a standalone `wrangler dev` or a deployed worker bundle it
+ * up-front, so they're unaffected — which makes the hang baffling to debug).
+ * This explicit adapter skips that import entirely, so dev and prod behave the
+ * same. The migration instance is the one exception — it wants raw `env.DB` so
+ * `ensureMigrated`'s Kysely migrator can create the tables (its `$context` is
+ * never resolved, so the hang doesn't apply there).
+ */
 declare const lunoraD1Adapter: (d1: Parameters<typeof d1Executor>[0]) => ReturnType<typeof lunoraAuthAdapter>;
 export { lunoraAuthAdapter, lunoraD1Adapter };

package/dist/adapter.d.ts

@@ -2,42 +2,42 @@ import { createAdapterFactory } from 'better-auth/adapters';
 import { d1Executor } from "./sql-store.js";
 import { AuthStore } from "./store.js";
 /**
-* A better-auth database adapter backed by an {@link AuthStore} — the bridge
-* that routes better-auth's reads and writes through Lunora's data layer
-* instead of better-auth's built-in D1/Kysely adapter. Pass the result as
-* `createAuth({ database: lunoraAuthAdapter(store) })`; better-auth's
-* `createAdapterFactory` handles id generation, default values, field-name
-* mapping and output shaping, so this only translates the cleaned CRUD calls
-* onto the store.
-*
-* ```ts
-* const auth = createAuth({
-*     secret: env.AUTH_SECRET,
-*     emailAndPassword: { enabled: true },
-*     database: lunoraAuthAdapter(lunoraStore), // lunoraStore writes via ctx.db
-* });
-* ```
-*
-* Scope: the {@link AuthStore} interface is single-table CRUD. better-auth's
-* relational `join` reads (an advanced opt-in) are not handled — pair the
-* adapter with `disableJoins` or let better-auth fall back to per-table reads.
-*/
+ * A better-auth database adapter backed by an {@link AuthStore} — the bridge
+ * that routes better-auth's reads and writes through Lunora's data layer
+ * instead of better-auth's built-in D1/Kysely adapter. Pass the result as
+ * `createAuth({ database: lunoraAuthAdapter(store) })`; better-auth's
+ * `createAdapterFactory` handles id generation, default values, field-name
+ * mapping and output shaping, so this only translates the cleaned CRUD calls
+ * onto the store.
+ *
+ * ```ts
+ * const auth = createAuth({
+ *     secret: env.AUTH_SECRET,
+ *     emailAndPassword: { enabled: true },
+ *     database: lunoraAuthAdapter(lunoraStore), // lunoraStore writes via ctx.db
+ * });
+ * ```
+ *
+ * Scope: the {@link AuthStore} interface is single-table CRUD. better-auth's
+ * relational `join` reads (an advanced opt-in) are not handled — pair the
+ * adapter with `disableJoins` or let better-auth fall back to per-table reads.
+ */
 declare const lunoraAuthAdapter: (store: AuthStore) => ReturnType<typeof createAdapterFactory>;
 /**
-* One-liner for the common case: a better-auth `database` backed by a Cloudflare
-* D1 binding, via Lunora's SQL store — equivalent to
-* `lunoraAuthAdapter(createSqlAuthStore(d1Executor(d1)))`.
-*
-* Prefer this over passing the raw `env.DB` as `database`. With raw D1,
-* better-auth resolves its Kysely adapter through a runtime `await import(...)`
-* inside `auth.$context`, and that dynamic import never settles under
-* `@cloudflare/vite-plugin`'s worker runner — so it hangs *every* auth request
-* in `pnpm dev` (a standalone `wrangler dev` or a deployed worker bundle it
-* up-front, so they're unaffected — which makes the hang baffling to debug).
-* This explicit adapter skips that import entirely, so dev and prod behave the
-* same. The migration instance is the one exception — it wants raw `env.DB` so
-* `ensureMigrated`'s Kysely migrator can create the tables (its `$context` is
-* never resolved, so the hang doesn't apply there).
-*/
+ * One-liner for the common case: a better-auth `database` backed by a Cloudflare
+ * D1 binding, via Lunora's SQL store — equivalent to
+ * `lunoraAuthAdapter(createSqlAuthStore(d1Executor(d1)))`.
+ *
+ * Prefer this over passing the raw `env.DB` as `database`. With raw D1,
+ * better-auth resolves its Kysely adapter through a runtime `await import(...)`
+ * inside `auth.$context`, and that dynamic import never settles under
+ * `@cloudflare/vite-plugin`'s worker runner — so it hangs *every* auth request
+ * in `pnpm dev` (a standalone `wrangler dev` or a deployed worker bundle it
+ * up-front, so they're unaffected — which makes the hang baffling to debug).
+ * This explicit adapter skips that import entirely, so dev and prod behave the
+ * same. The migration instance is the one exception — it wants raw `env.DB` so
+ * `ensureMigrated`'s Kysely migrator can create the tables (its `$context` is
+ * never resolved, so the hang doesn't apply there).
+ */
 declare const lunoraD1Adapter: (d1: Parameters<typeof d1Executor>[0]) => ReturnType<typeof lunoraAuthAdapter>;
 export { lunoraAuthAdapter, lunoraD1Adapter };

package/dist/index.d.mts

@@ -1,7 +1,7 @@
 export { lunoraAuthAdapter, lunoraD1Adapter } from "./adapter.mjs";
 import { LunoraError } from '@lunora/errors';
-import { L as LunoraAuth, a as LunoraAuthOptions } from "./packem_shared/create-auth.d-Mwhb4gSc.mjs";
-export { c as createAuth, r as resolveAuthOptions } from "./packem_shared/create-auth.d-Mwhb4gSc.mjs";
+import { L as LunoraAuth, a as LunoraAuthOptions } from "./packem_shared/create-auth.d-COcIS_KU.mjs";
+export { c as createAuth, r as resolveAuthOptions } from "./packem_shared/create-auth.d-COcIS_KU.mjs";
 export { type LunoraAuthApiContext, LunoraAuthHeadersError, type WithAuthPluginsMiddleware, type WithAuthPluginsOptions, withAuthPlugins } from "./middleware.mjs";
 export { default as authTables } from "./schema.mjs";
 import { BetterAuthOptions } from 'better-auth';
@@ -12,17 +12,17 @@ export { type VerifyTurnstileMiddlewareOptions, verifyTurnstileMiddleware } from
 import 'better-auth/adapters';
 import '@lunora/server';
 /**
-* A timestamp as it leaves the admin API: epoch-ms (better-auth stores `Date`s,
-* which we normalize on output) or `null` when the column is unset.
-*/
+ * A timestamp as it leaves the admin API: epoch-ms (better-auth stores `Date`s,
+ * which we normalize on output) or `null` when the column is unset.
+ */
 type AuthTimestamp = null | number;
 /**
-* One user row as the admin API surfaces it. The fixed keys mirror better-auth's
-* core `user` table plus the `admin()` plugin columns (`role`/`banned`/…); the
-* index signature carries any app-defined `user.additionalFields` so callers
-* (the studio) can render them generically. Password material never lives on
-* this row (it's in the `account` table) and is never returned.
-*/
+ * One user row as the admin API surfaces it. The fixed keys mirror better-auth's
+ * core `user` table plus the `admin()` plugin columns (`role`/`banned`/…); the
+ * index signature carries any app-defined `user.additionalFields` so callers
+ * (the studio) can render them generically. Password material never lives on
+ * this row (it's in the `account` table) and is never returned.
+ */
 interface AuthAdminUser {
   [key: string]: unknown;
   banExpires?: AuthTimestamp;
@@ -38,12 +38,12 @@ interface AuthAdminUser {
   updatedAt?: AuthTimestamp;
 }
 /**
-* One session row as the admin API surfaces it. Mirrors better-auth's `session`
-* table; `impersonatedBy` is set when the session was minted by
-* {@link AuthAdmin.impersonateUser}. The signing `token` is stripped — it's a
-* bearer credential, and the only place we hand one back is the explicit
-* impersonation flow.
-*/
+ * One session row as the admin API surfaces it. Mirrors better-auth's `session`
+ * table; `impersonatedBy` is set when the session was minted by
+ * {@link AuthAdmin.impersonateUser}. The signing `token` is stripped — it's a
+ * bearer credential, and the only place we hand one back is the explicit
+ * impersonation flow.
+ */
 interface AuthAdminSession {
   [key: string]: unknown;
   createdAt?: AuthTimestamp;
@@ -108,10 +108,10 @@ interface AuthTeamMember {
   userId: string;
 }
 /**
-* One custom organization role (from the organization plugin's dynamic
-* access-control). `permission` is a JSON string of a `resource → actions[]` map
-* as stored; the studio parses it for display/editing.
-*/
+ * One custom organization role (from the organization plugin's dynamic
+ * access-control). `permission` is a JSON string of a `resource → actions[]` map
+ * as stored; the studio parses it for display/editing.
+ */
 interface AuthOrgRole {
   [key: string]: unknown;
   createdAt?: AuthTimestamp;
@@ -135,12 +135,12 @@ interface AuthPage<T> {
   total: number;
 }
 /**
-* Which admin surfaces a given auth instance supports, derived from the enabled
-* better-auth plugins (and any {@link CreateAuthAdminOptions.features} overrides).
-* The studio calls {@link AuthAdmin.capabilities} once and renders only the
-* panels whose capability is `true` — so a deployment that doesn't enable, say,
-* the `organization` plugin never shows an Organizations section.
-*/
+ * Which admin surfaces a given auth instance supports, derived from the enabled
+ * better-auth plugins (and any {@link CreateAuthAdminOptions.features} overrides).
+ * The studio calls {@link AuthAdmin.capabilities} once and renders only the
+ * panels whose capability is `true` — so a deployment that doesn't enable, say,
+ * the `organization` plugin never shows an Organizations section.
+ */
 interface AuthCapabilities {
   /** Linked-account browsing/unlinking — core (the `account` table always exists). */
   accounts: boolean;
@@ -154,12 +154,12 @@ interface AuthCapabilities {
   twoFactor: boolean;
 }
 /**
-* One app/plugin-defined field the create-user form should render, derived from
-* the merged better-auth `user` table (core + plugin + `additionalFields`). Only
-* user-settable columns are surfaced — server-managed flags (`input: false`),
-* foreign keys (`references`), and the core columns the form already handles
-* (`email`/`name`/`role`/ban state/…) are filtered out upstream.
-*/
+ * One app/plugin-defined field the create-user form should render, derived from
+ * the merged better-auth `user` table (core + plugin + `additionalFields`). Only
+ * user-settable columns are surfaced — server-managed flags (`input: false`),
+ * foreign keys (`references`), and the core columns the form already handles
+ * (`email`/`name`/`role`/ban state/…) are filtered out upstream.
+ */
 interface AuthUserFieldSpec {
   /** Logical field name (the key passed back in `createUser`'s `data`). */
   name: string;
@@ -171,13 +171,13 @@ interface AuthUserFieldSpec {
   unique: boolean;
 }
 /**
-* A rich, read-only description of the deployment's auth configuration for the
-* studio's config panel and dynamic create-user form. Unlike
-* {@link AuthCapabilities} (five booleans that gate panels), this exposes *what*
-* is configured — enabled plugins, email/password + social sign-in, the
-* user-settable fields, organization sub-features (teams / custom roles), and
-* the session + rate-limit policy — without ever leaking a secret.
-*/
+ * A rich, read-only description of the deployment's auth configuration for the
+ * studio's config panel and dynamic create-user form. Unlike
+ * {@link AuthCapabilities} (five booleans that gate panels), this exposes *what*
+ * is configured — enabled plugins, email/password + social sign-in, the
+ * user-settable fields, organization sub-features (teams / custom roles), and
+ * the session + rate-limit policy — without ever leaking a secret.
+ */
 interface AuthConfigInfo {
   /** The same capability booleans {@link AuthAdmin.capabilities} returns, embedded so a single call drives the whole panel. */
   capabilities: AuthCapabilities;
@@ -185,7 +185,8 @@ interface AuthConfigInfo {
   emailAndPassword: boolean;
   /** Organization plugin sub-features. */
   organization: {
-    enabled: boolean; /** Custom roles / dynamic access control (`organizationRole` table present). */
+    enabled: boolean;
+    /** Custom roles / dynamic access control (`organizationRole` table present). */
     roles: boolean;
     /** Teams (`team` table present). */
     teams: boolean;
@@ -236,14 +237,14 @@ interface ImpersonationResult {
   user: AuthAdminUser;
 }
 /**
-* The full read + write surface the studio's auth dashboard drives, backed by
-* better-auth's tables. Returned by {@link createAuthAdmin}. The runtime accepts
-* a structurally-compatible object as its `authAdmin` option and exposes each
-* method behind an admin-token-gated endpoint. Methods whose backing plugin is
-* absent still exist (they're not conditionally omitted) but the studio gates
-* them on {@link AuthAdmin.capabilities}; calling one for an unconfigured plugin
-* surfaces the underlying adapter error.
-*/
+ * The full read + write surface the studio's auth dashboard drives, backed by
+ * better-auth's tables. Returned by {@link createAuthAdmin}. The runtime accepts
+ * a structurally-compatible object as its `authAdmin` option and exposes each
+ * method behind an admin-token-gated endpoint. Methods whose backing plugin is
+ * absent still exist (they're not conditionally omitted) but the studio gates
+ * them on {@link AuthAdmin.capabilities}; calling one for an unconfigured plugin
+ * surfaces the underlying adapter error.
+ */
 interface AuthAdmin {
   /** Directly add an existing user as an org member (server-side, no invitation/acceptance). */
   addMember: (input: {
@@ -427,152 +428,152 @@ interface AuthAdmin {
 /** Options for {@link createAuthAdmin}. */
 interface CreateAuthAdminOptions {
   /**
-  * Force individual {@link AuthCapabilities} on or off regardless of which
-  * plugins are detected — e.g. `{ impersonate: false }`-style opt-outs by
-  * setting `admin: false`, or hiding linked accounts with `accounts: false`.
-  * A capability is reported only when both its plugin is enabled *and* its
-  * override isn't `false`.
-  */
+   * Force individual {@link AuthCapabilities} on or off regardless of which
+   * plugins are detected — e.g. `{ impersonate: false }`-style opt-outs by
+   * setting `admin: false`, or hiding linked accounts with `accounts: false`.
+   * A capability is reported only when both its plugin is enabled *and* its
+   * override isn't `false`.
+   */
   features?: Partial<AuthCapabilities>;
   /**
-  * User id recorded as the impersonator on sessions minted by
-  * {@link AuthAdmin.impersonateUser}. Defaults to the impersonated user's own
-  * id (a self-reference) since the trusted admin plane has no acting user.
-  */
+   * User id recorded as the impersonator on sessions minted by
+   * {@link AuthAdmin.impersonateUser}. Defaults to the impersonated user's own
+   * id (a self-reference) since the trusted admin plane has no acting user.
+   */
   impersonatedBy?: string;
   /**
-  * How long (in seconds) an impersonation session lives. Must be a positive
-  * finite integer. Capped at 24 × {@link DEFAULT_IMPERSONATION_SECONDS}
-  * (86 400 s / 24 h). Defaults to {@link DEFAULT_IMPERSONATION_SECONDS}
-  * (3 600 s / 1 h).
-  */
+   * How long (in seconds) an impersonation session lives. Must be a positive
+   * finite integer. Capped at 24 × {@link DEFAULT_IMPERSONATION_SECONDS}
+   * (86 400 s / 24 h). Defaults to {@link DEFAULT_IMPERSONATION_SECONDS}
+   * (3 600 s / 1 h).
+   */
   impersonationSeconds?: number;
 }
 /**
-* A normalized failure from an admin operation. better-auth throws `APIError`s
-* carrying a `body.code` (e.g. `USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL`); we
-* surface that `code` so the runtime can map it onto an HTTP status and the
-* studio can show a meaningful message instead of a generic 500.
-*/
+ * A normalized failure from an admin operation. better-auth throws `APIError`s
+ * carrying a `body.code` (e.g. `USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL`); we
+ * surface that `code` so the runtime can map it onto an HTTP status and the
+ * studio can show a meaningful message instead of a generic 500.
+ */
 declare class LunoraAuthAdminError extends LunoraError {
   constructor(message: string, code: string);
 }
 /**
-* Build the studio's auth user-management plane on top of better-auth.
-*
-* Pass the result as the runtime's `authAdmin` option; the runtime exposes each
-* method behind an admin-token-gated `/_lunora/admin/auth/*` endpoint. The set
-* of usable surfaces is reported by {@link AuthAdmin.capabilities} — derived
-* from the enabled better-auth plugins, so enabling `admin()`, `organization()`,
-* `twoFactor()`, or the passkey plugin in the auth config is what lights up the
-* matching dashboard panels.
-*
-* **Trust model — important.** These operations talk to better-auth's
-* `internalAdapter` (and `adapter`/password hasher) **directly**, deliberately
-* bypassing the plugins' own endpoints, which require the caller to hold an
-* admin-role session. That session check is the wrong gate here: the runtime
-* already authorizes every call with `LUNORA_ADMIN_TOKEN`, so this helper acts
-* as a trusted server-side operator. It is therefore not an end-user-callable
-* API — never expose it on a path that isn't admin-token gated.
-*
-* `auth.$context` is a promise (better-auth resolves the adapter, password
-* config, etc. lazily); we memoize it so the first call pays the cost once.
-*/
+ * Build the studio's auth user-management plane on top of better-auth.
+ *
+ * Pass the result as the runtime's `authAdmin` option; the runtime exposes each
+ * method behind an admin-token-gated `/_lunora/admin/auth/*` endpoint. The set
+ * of usable surfaces is reported by {@link AuthAdmin.capabilities} — derived
+ * from the enabled better-auth plugins, so enabling `admin()`, `organization()`,
+ * `twoFactor()`, or the passkey plugin in the auth config is what lights up the
+ * matching dashboard panels.
+ *
+ * **Trust model — important.** These operations talk to better-auth's
+ * `internalAdapter` (and `adapter`/password hasher) **directly**, deliberately
+ * bypassing the plugins' own endpoints, which require the caller to hold an
+ * admin-role session. That session check is the wrong gate here: the runtime
+ * already authorizes every call with `LUNORA_ADMIN_TOKEN`, so this helper acts
+ * as a trusted server-side operator. It is therefore not an end-user-callable
+ * API — never expose it on a path that isn't admin-token gated.
+ *
+ * `auth.$context` is a promise (better-auth resolves the adapter, password
+ * config, etc. lazily); we memoize it so the first call pays the cost once.
+ */
 declare const createAuthAdmin: (auth: LunoraAuth, options?: CreateAuthAdminOptions) => AuthAdmin;
 /**
-* Default basePath used by better-auth's client + handler. Override via the
-* second argument if you mount the auth routes somewhere else.
-*/
+ * Default basePath used by better-auth's client + handler. Override via the
+ * second argument if you mount the auth routes somewhere else.
+ */
 declare const DEFAULT_AUTH_BASE_PATH: string;
 /**
-* Route an inbound `Request` to better-auth if the path falls under
-* `basePath`; otherwise return `null` so the caller can continue dispatching.
-*
-* Better-auth handles arbitrarily nested paths (`/api/auth/sign-in/email`,
-* `/api/auth/callback/github`, …), so we use prefix matching instead of the
-* exact-path map `createWorker` consumes for top-level routes.
-*/
+ * Route an inbound `Request` to better-auth if the path falls under
+ * `basePath`; otherwise return `null` so the caller can continue dispatching.
+ *
+ * Better-auth handles arbitrarily nested paths (`/api/auth/sign-in/email`,
+ * `/api/auth/callback/github`, …), so we use prefix matching instead of the
+ * exact-path map `createWorker` consumes for top-level routes.
+ */
 declare const handleAuthRequest: (auth: LunoraAuth, request: Request, basePath?: string) => Promise<Response | undefined>;
 /**
-* Apply better-auth's required schema (`user`, `session`, `account`,
-* `verification`) to the configured database. Idempotent — better-auth
-* diffs the existing schema and only runs the missing DDL.
-*
-* Cached per `options` reference so the diff cost (one PRAGMA-style sweep
-* per table) doesn't fire on every request. In Cloudflare Workers the same
-* `env.DB` binding is reused across invocations within a single isolate, so
-* caching against the options object — which captures the binding — is
-* sufficient.
-*
-* For production you should prefer pre-applying the schema at deploy time
-* via `compileMigrationsSql` + `wrangler d1 execute`; this helper exists for
-* dev/playground and small deployments.
-*/
+ * Apply better-auth's required schema (`user`, `session`, `account`,
+ * `verification`) to the configured database. Idempotent — better-auth
+ * diffs the existing schema and only runs the missing DDL.
+ *
+ * Cached per `options` reference so the diff cost (one PRAGMA-style sweep
+ * per table) doesn't fire on every request. In Cloudflare Workers the same
+ * `env.DB` binding is reused across invocations within a single isolate, so
+ * caching against the options object — which captures the binding — is
+ * sufficient.
+ *
+ * For production you should prefer pre-applying the schema at deploy time
+ * via `compileMigrationsSql` + `wrangler d1 execute`; this helper exists for
+ * dev/playground and small deployments.
+ */
 declare const ensureMigrated: (auth: LunoraAuth | {
   options: LunoraAuthOptions;
 }) => Promise<void>;
 /**
-* Compile better-auth's migrations to a single SQL string. Useful for
-* `wrangler d1 execute --file -` in CI so the deploy step applies the schema
-* before the first user request.
-*
-* Compiles from the SAME resolved options `createAuth` runs with (via
-* `resolveAuthOptions`), not the raw caller options — so the schema includes the
-* `rateLimit` table the worker's default-on durable limiter writes to. Compiling
-* from the raw options would omit it, and the running worker would then write to
-* a table the migration never created.
-*/
+ * Compile better-auth's migrations to a single SQL string. Useful for
+ * `wrangler d1 execute --file -` in CI so the deploy step applies the schema
+ * before the first user request.
+ *
+ * Compiles from the SAME resolved options `createAuth` runs with (via
+ * `resolveAuthOptions`), not the raw caller options — so the schema includes the
+ * `rateLimit` table the worker's default-on durable limiter writes to. Compiling
+ * from the raw options would omit it, and the running worker would then write to
+ * a table the migration never created.
+ */
 declare const compileMigrationsSql: (options: LunoraAuthOptions) => Promise<string>;
 /**
-* Lunora-friendly view over better-auth's `session` option.
-*
-* This is a typed alias for better-auth's own `session` shape — Lunora stays a
-* thin wrapper, so we don't reimplement the fields, we just give them a named,
-* documented home so callers get autocomplete without reaching into
-* `BetterAuthOptions`. The most relevant fields for session rotation / richer
-* policies are `expiresIn` (absolute session lifetime, in seconds),
-* `updateAge` (rolling-rotation interval, in seconds — how often an active
-* session's expiry is pushed forward; `0` rotates on every use),
-* `disableSessionRefresh` (turn rolling rotation off entirely so sessions
-* expire at the absolute `expiresIn` regardless of activity), `freshAge`
-* (freshness window, in seconds, for sensitive operations like account
-* deletion; `0` treats every session as fresh — not recommended), and
-* `cookieCache` (opt-in signed-cookie session cache to skip DB reads).
-*
-* See better-auth's `session` option for the full field list.
-*/
+ * Lunora-friendly view over better-auth's `session` option.
+ *
+ * This is a typed alias for better-auth's own `session` shape — Lunora stays a
+ * thin wrapper, so we don't reimplement the fields, we just give them a named,
+ * documented home so callers get autocomplete without reaching into
+ * `BetterAuthOptions`. The most relevant fields for session rotation / richer
+ * policies are `expiresIn` (absolute session lifetime, in seconds),
+ * `updateAge` (rolling-rotation interval, in seconds — how often an active
+ * session's expiry is pushed forward; `0` rotates on every use),
+ * `disableSessionRefresh` (turn rolling rotation off entirely so sessions
+ * expire at the absolute `expiresIn` regardless of activity), `freshAge`
+ * (freshness window, in seconds, for sensitive operations like account
+ * deletion; `0` treats every session as fresh — not recommended), and
+ * `cookieCache` (opt-in signed-cookie session cache to skip DB reads).
+ *
+ * See better-auth's `session` option for the full field list.
+ */
 type SessionPolicy = NonNullable<BetterAuthOptions["session"]>;
 /**
-* Validate a {@link SessionPolicy} and return it unchanged (pass-through).
-*
-* better-auth happily accepts the `session` block verbatim, so the only job
-* here is to catch obviously-broken numeric inputs at construction time —
-* negative or non-finite durations — rather than letting them produce
-* surprising cookie expiries at runtime. Field names mirror better-auth's
-* `session` option exactly so the validated object forwards 1:1.
-*/
+ * Validate a {@link SessionPolicy} and return it unchanged (pass-through).
+ *
+ * better-auth happily accepts the `session` block verbatim, so the only job
+ * here is to catch obviously-broken numeric inputs at construction time —
+ * negative or non-finite durations — rather than letting them produce
+ * surprising cookie expiries at runtime. Field names mirror better-auth's
+ * `session` option exactly so the validated object forwards 1:1.
+ */
 declare const validateSessionPolicy: (policy: SessionPolicy) => SessionPolicy;
 /**
-* Ready-made {@link SessionPolicy} presets covering the common rotation /
-* expiry trade-offs. Spread or override fields as needed:
-*
-* ```ts
-* import { createAuth, sessionPresets } from "@lunora/auth";
-*
-* export const auth = createAuth({
-*     secret: env.AUTH_SECRET,
-*     database: env.DB,
-*     session: { ...sessionPresets.rolling, freshAge: 60 * 5 },
-* });
-* ```
-*
-* - `rolling` — balanced default: 7-day absolute expiry, rotated once per day,
-*   with a 60s signed-cookie session cache so bursts of authenticated calls
-*   skip the per-request DB session read.
-* - `strict` — short, security-sensitive: 1-hour expiry, 15-minute rotation,
-*   cookie cache **off** (fast revocation / short freshness is the whole point).
-* - `longLived` — low-friction consumer apps: 30-day expiry, daily rotation,
-*   with the same 60s cookie cache as `rolling`.
-*/
+ * Ready-made {@link SessionPolicy} presets covering the common rotation /
+ * expiry trade-offs. Spread or override fields as needed:
+ *
+ * ```ts
+ * import { createAuth, sessionPresets } from "@lunora/auth";
+ *
+ * export const auth = createAuth({
+ *     secret: env.AUTH_SECRET,
+ *     database: env.DB,
+ *     session: { ...sessionPresets.rolling, freshAge: 60 * 5 },
+ * });
+ * ```
+ *
+ * - `rolling` — balanced default: 7-day absolute expiry, rotated once per day,
+ *   with a 60s signed-cookie session cache so bursts of authenticated calls
+ *   skip the per-request DB session read.
+ * - `strict` — short, security-sensitive: 1-hour expiry, 15-minute rotation,
+ *   cookie cache **off** (fast revocation / short freshness is the whole point).
+ * - `longLived` — low-friction consumer apps: 30-day expiry, daily rotation,
+ *   with the same 60s cookie cache as `rolling`.
+ */
 declare const sessionPresets: Record<"longLived" | "rolling" | "strict", SessionPolicy>;
 export { type AuthAccount, type AuthAdmin, type AuthAdminSession, type AuthAdminUser, type AuthCapabilities, type AuthConfigInfo, type AuthInvitation, type AuthMember, type AuthOrgRole, type AuthOrganization, type AuthPage, type AuthPasskey, type AuthTeam, type AuthTeamMember, type AuthTimestamp, type AuthUserFieldSpec, type CreateAuthAdminOptions, DEFAULT_AUTH_BASE_PATH, type ImpersonationResult, type ListUsersOptions, type LunoraAuth, LunoraAuthAdminError, type LunoraAuthOptions, type SessionPolicy, compileMigrationsSql, createAuthAdmin, ensureMigrated, handleAuthRequest, sessionPresets, validateSessionPolicy };